CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/07/2026 |
| CVE-2026-21662 | CRITICAL9.8 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.
This issue affects FM Systems Employee: before 2025.3.1. | 31/07/2026 |
| CVE-2024-32931 | MEDIUM5.7 | Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. | 01/08/2024 |
| CVE-2024-32865 | HIGH7.3 | Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. | 01/08/2024 |
| CVE-2024-32862 | HIGH8.1 | Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. | 01/08/2024 |
| CVE-2024-32758 | HIGH7.5 | Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange | 01/08/2024 |
| CVE-2024-32864 | HIGH8.1 | Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) | 01/08/2024 |
| CVE-2024-32863 | HIGH8.8 | Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) | 01/08/2024 |
| CVE-2022-21940 | MEDIUM6.1 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie. | 09/02/2023 |
| CVE-2022-21939 | MEDIUM6.1 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie. | 09/02/2023 |
| CVE-2021-36204 | HIGH7.5 | Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text. | 13/01/2023 |
| CVE-2021-36206 | MEDIUM6.1 | All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries. | 28/10/2022 |
| CVE-2022-21936 | MEDIUM6.5 | On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI. | 07/10/2022 |
| CVE-2021-36200 | MEDIUM5.3 | Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users. | 22/07/2022 |
| CVE-2022-21938 | MEDIUM5.4 | Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the MUI Graphics web interface. | 15/06/2022 |
| CVE-2022-21937 | MEDIUM5.4 | Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface. | 15/06/2022 |
| CVE-2022-21935 | HIGH7.5 | A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. | 15/06/2022 |
| CVE-2022-21934 | HIGH8.8 | Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2. | 06/05/2022 |